f27b6b1a925d0e125c526312e1960e5adeccfb36a7880475e254cc8e5089eb65

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a1b6b768be08d7bd7bce682eb7564db.html
Size 106KB
Sample240213-2njvescc23
SHA256 f27b6b1a925d0e125c526312e1960e5adeccfb36a7880475e254cc8e5089eb65
MD5 9a1b6b768be08d7bd7bce682eb7564db
SHA1 311f2d687932b786abce9914bd26e135b66ea9a1
SHA512 15e60b5835cfe08da220f729219f431fc2ee33157fd8a3d0e67de86d10aa1a83088684ace221b54a10d7a47988065774ae054feb988d954621d31a598594e01b
SSDEEP 3072:fPEijZeqLVEijZeqLczDQqs8PNB1R4XGHULpcSuxw0sVAxxmzg:fPEijZeqLVEijZeqLcl1
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
21	sites.google.com
34	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
1008	msedge.exe
1008	msedge.exe
2336	identity_helper.exe
2336	identity_helper.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 3944	1008	msedge.exe	39
PID 1008 wrote to memory of 3944	1008	msedge.exe	39
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 1620	1008	msedge.exe	84
PID 1008 wrote to memory of 976	1008	msedge.exe	85
PID 1008 wrote to memory of 976	1008	msedge.exe	85
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86
PID 1008 wrote to memory of 4988	1008	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9a1b6b768be08d7bd7bce682eb7564db.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe471746f8,0x7ffe47174708,0x7ffe47174718
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1744 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,13196374112169517894,10668864656990640207,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b
MD5 7a5862a0ca86c0a4e8e0b30261858e1f
SHA1 ee490d28e155806d255e0f17be72509be750bf97
SHA512 0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 21KB
SHA256 74bece3266374f5aa3043309d94a5cbd2ea847be1a5bc57460693c165a5a0b09
MD5 a8b7b256962eac35b073d634868a231c
SHA1 dfc1d2a914582631c96ad1eb929ebd30ff31efe0
SHA512 3957a2770948727731faf45bb74574e9597d46a89c8bf7d6f9ffbc21b32428bc8a88836d7e91f33753ecb3c0bd0fc3f23f431f687128fd83f6309ef753f7715a
SSDEEP 384:nZQXI5ELj0kUChsFFP96HMNYmuG8LumdQ86d2qXr8gL8D12aHWjadHMibyQ:IKEkIsXIMYnLod2YnL8D1kjadHM8yQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 44KB
SHA256 5a5a77f2321c2400046e66dc560304bf4187a2368f62aaa84ef9cdf21d7b726a
MD5 aa2a65c96f7fdb26505e70abac1d03cf
SHA1 f960f30e0aa266e8b23d52c241249e8ca18c1679
SHA512 f2c479bd9bdf8531d5cabcc6b722695aa0ce7de473bc5623beced1a45ee7d7418d43f8f9fad1a3db7f401c8678e7fd354159b0620f18bb024f534893e40a1071
SSDEEP 768:zhTwQJmZgyqod4BSVNKsieO+qMrWpN2CwxWdUOimOCfqPX52qTx4ZAVHbNf/Kp6c:zh7yzfVjiR+5ygWd7iBK+p2GR53KP
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 baeef949bd9ae700552944a97ea36b2751938e10cf090b546d1e2863434f1f28
MD5 fecb291769947bee813f3ac20b551d26
SHA1 4a7cae68ede1cf8b712477386493215360abc3f3
SHA512 1f5c1dd0fd2856aab27594b0d299f594d011b4ca1113806ef50ef136bc152baf9184f8394fb3a13359e7045687ac7390c705fe594ee6ba0fdad05e417e1ceae8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 fb9893d7e1800ee11ff7b57e315a4bd2ab7cc27b260688f305f960ed77c65852
MD5 4ca332dbb33ca35c1a1e73206e276a6b
SHA1 3aea885b9ee637a0486648a3d4689b403a802ba4
SHA512 b4c01a221652bb6c082107b2f224f0da7fa01c32dcff08ba7c436be3add2cb9258e99949ae775e47dd5826414b588440fe6e347ff44796762e2c974523efb161
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3f54897f9e50d94b1db7f7f22ca54bc8e5eaaddb5d5f555d87423bb439d70c15
MD5 7c0ee1b30c44470795c9ec874402565c
SHA1 cf92819eb96c49a66f95407ef08f374c3d9d9826
SHA512 c77b925cc59cfe373769952a93c5b66704f4fc0eddd21b2fe5cce6c1c19d6a28a4e66bc1ccae6bb382fbfbcb2b8fffd7908e3e513b7fc82fca5f64c0d07ef766
SSDEEP 96:nq2kY01eoZ6wpvWMoiVmde1eWs8q1kCk11sEDa2kqijUWQyV+VD7AiEwb:nlkFd6GWMFeWs8q1kCk11sEDa2ujrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 37fb7d69676368131af376bcf76f1be96c41a1a82d7a3f86ba4c3346049bf33d
MD5 215ced237e98cdfb947ff87153336ac6
SHA1 52b7ce73d5d7a51fa265c236fa480166910d8d67
SHA512 8c81cda9c0b13fa062aa8cac5532c5046e2828bf867af77bedf146ea62d03957d1ef05b06229c7b20a80aae73b75d82694958224e7f4a47220d480ad00b74c17
SSDEEP 96:nq0kd01eoZ6wpvWMoiVmdeHk1jUWQyV+VDCzia:nTkKd6GWMXijrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d9b4bd5716dcd045708173da5512fda0afae096b23e65aaec575aee28c787017
MD5 92231e29133adb6c0470755c8605bcb2
SHA1 546bbe4479f5699950ec4c535c7727063dda0220
SHA512 72b3a474989d21d081091623ea04221d0212bfa88ee07c49fa26c46a2becf7851088b533cd840396ccaff32722cfdd42fefc3470134a06efcf8117dcd1ed46e2
SSDEEP 96:nq2k401eoZ6wpvWMoiVmde1eWs8q1kCk11sEDa2kOijUWQyV+VDCAiEwb:nlkld6GWMFeWs8q1kCk11sEDa2ejrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb
MD5 52826cef6409f67b78148b75e442b5ea
SHA1 a675db110aae767f5910511751cc3992cddcc393
SHA512 f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c
SSDEEP 768:nXwWPv8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2LlxQrUEYtLAO:nXwWPvu1jafLzPtcO
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7987df3d2e2e801c1ba9bb55510b1ad72933d31be651b0b52f72b32adadc109f
MD5 b985f5dca3fc49759ed86c0cf809ebbf
SHA1 04762b8e52884109e87eb043001e46ba22a04037
SHA512 3208deffb1510180e54a117046245bd8e9872a5112a02e9fe7905bbfe540e497604476bc5e79fbd75a0c886f949bfc6f7146ade09154c7b8ebfee275ece1f64a
SSDEEP 192:IoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDGe2RUOappnZhTw8AftwKA:w9iIxuERzA83h09RZxYUSZM86W24
MD5 SHA1 SHA512 SSDEEP

Submit Download